323 个 · 按相关度排序
Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.
中文简介正在准备中。当前显示原文说明。
Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.
中文简介正在准备中。当前显示原文说明。
Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.
中文简介正在准备中。当前显示原文说明。
Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.
中文简介正在准备中。当前显示原文说明。
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
中文简介正在准备中。当前显示原文说明。
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
中文简介正在准备中。当前显示原文说明。
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
中文简介正在准备中。当前显示原文说明。
Analyzes a PE file's import and export tables to infer capability: mapping imported APIs to behaviors (networking, crypto, injection, persistence), spotting dynamic-resolution stubs, and reading exports of malicious DLLs. Activates for requests to analyze PE imports, inspect the IAT/exports, or infer capability from API usage.
中文简介正在准备中。当前显示原文说明。
Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.
中文简介正在准备中。当前显示原文说明。
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.
中文简介正在准备中。当前显示原文说明。
Recovers obfuscated strings and resolves dynamically loaded APIs in malware: reversing XOR/stack-string/encoding schemes and mapping API-hash lookups back to function names. Activates for requests to deobfuscate strings, decode stack strings, or resolve API hashing in a binary.
中文简介正在准备中。当前显示原文说明。
Plan and run safe reverse engineering, decompilation, disassembly, instrumentation, de-obfuscation, and anti-analysis countermeasures for binaries, firmware, mobile apps, WebAssembly, JavaScript bundles, and .NET assemblies. Use for behavior reconstruction, cross-layer Electron tracing, REA, reversing strategy, decompiler selection, binary analysis, malware-style triage, unpacking, deobfuscation, defeating anti-debug or anti-VM checks, Wakaru, Ghidra, IDA, RetDec, radare2, Rizin, Frida, angr, YARA, or command scripts that capture analysis stats.
中文简介正在准备中。当前显示原文说明。
Analyze suspicious SMS/email messages, phishing links, redirects, domains, payloads, malware indicators, and suspected C2 infrastructure safely. Use when the user provides spam, smishing/phishing content, raw .eml headers, URLs, QR links, attachments, hashes, strange payloads, redirect chains, DNS/WHOIS/RDAP questions, C2 clues, exploit-chain questions, or asks what defenses to apply.
中文简介正在准备中。当前显示原文说明。
Use when reverse engineering binaries, firmware, mobile apps, JavaScript/Electron apps, .NET assemblies, network protocols, or malware samples; when decompiling, deobfuscating, unpacking, debugging, or hooking shipped artifacts; when solving CTF challenges (pwn, crypto, forensics, web); when a conclusion needs evidence from a shipped artifact rather than available source; or when coordinating authorized security assessments. Analysis-first and consent-gated — all active work requires written authorization and an approved scope. Do not use for ordinary review of source code you already have.
中文简介正在准备中。当前显示原文说明。
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.
中文简介正在准备中。当前显示原文说明。
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
中文简介正在准备中。当前显示原文说明。
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
中文简介正在准备中。当前显示原文说明。
Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.
中文简介正在准备中。当前显示原文说明。
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
中文简介正在准备中。当前显示原文说明。
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.
中文简介正在准备中。当前显示原文说明。
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
中文简介正在准备中。当前显示原文说明。
Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.
中文简介正在准备中。当前显示原文说明。
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.
中文简介正在准备中。当前显示原文说明。
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
中文简介正在准备中。当前显示原文说明。